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ABSTRACT 

This thesis provides a review and evaluation of the 
Navy's implementation of the Federal Managers 1 Financial 
Integrity Act. Topics considered include: internal control 
in the Federal Government; overview of the internal control 
evaluation system; the Department of the Navy's internal 
control program including Navy implementation problems; and 
Navy solutions and shortcomings to the implementation 
problems. The research consisted of interviews with Naval 
activities on implementation problems and solutions and a 
review of relevant General Accounting Office audits and 
other relevant instructions and studies. 

The conclusion was reached that the Navy has made fair 
progress in implementing the Act but further action is 
required. Recommended actions include increasing Navy 
efforts to incorporate the internal control process into the 
overall management process, reducing the paperwork burden 
and gaining line manager support of the process in order to 
evolve the Navy's system into a more effective program. 
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I. INTRODUCTION 



A. PURPOSE 

The Federal Managers' Financial Integrity Act of 1982 
(FMFIA) requires department and agency managers to identify 
internal control and accounting system weaknesses that can 
lead to fraud, waste and abuse in government operations. The 
issue of implementing an effective internal control program 
in the Navy is very important. With increasing public 
scrutiny over the misuse of government assets. Navy managers 
will need to become more concerned with obtaining and 
utilizing resources effectively and efficiently in 
accomplishing their objectives. One means to achieving these 
objectives is an effective internal control program. The 
FMFIA provides an important impetus to restoring public 
confidence in the management of the government. In its 
current implementation of the Act, the Navy has made a 
concerted effort to comply with the Act's spirit and letter, 
and has made some progress in greater organizational 

coverage and more effective internal control evaluations. 
Implementation of an effective internal control program in 
the Navy to meet the objectives of the FMFIA has not been 
smooth sailing for the Navy and other federal agencies as 
they have encountered numerous implementation problems. The 
purpose of this thesis is to review and evaluate the Navy's 
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Progress in implementing the FMFIA including discussion of 
past implementation problems and to identify areas for 
improvement that managers can use to help them with the 
internal control process. 

B. BACKGROUND 

The Budget and Accounting Act of 1950 required the head 
of each department and agency to establish and maintain 
adequate systems of internal control. 

With growing concern over numerous publicized cases of 
government mismanagement of resources. Congress amended the 
Budget and Accounting Act via the FMFIA to require ongoing 
evaluations and reports on the adequacy of the system of 
internal controls. The Act further requires federal managers 
to correct the weaknesses and report annually to the 
President and the Congress on their programs. The FMFIA also 
required the Office of Management and Budget (OMB) to 
consult with the Comptroller General of the United States to 
establish guidelines for these evaluations and reports. 
OMB revised the already established government policy on 
internal control and assigned management the responsibility 
of establishing, maintaining, reviewing and improving 
internal control systems in each agency. 

Unfortunately, the Navy has experienced implementation 
difficulties with the FMFIA. Some of the implementation 
problems encountered by the Navy include initial lack of 
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no training for 



line 



guidance from the headquarters level, 
managers on how to perform required reviews, significant 
resistance from line managers to complete required reviews 
and the significant amount of time and paperwork burden 
associated with the entire management control review 
process . 



C. SCOPE AND METHODOLOGY 

The objective of this thesis is to examine and evaluate 
the Department of the Navy's progress in implementing the 
Act. The history and evolution of internal control in the 
Federal Government and an overview of the current internal 
control evaluation system will be reviewed. 

This thesis then presents the research effort by first 
presenting a history of the Navy's internal control program, 
a review of the Navy's financial management structure and 
accounting systems weaknesses. Then the problems experienced 
by the Navy in implementing an effective internal control 
program are discussed. This is followed by examining the 
solutions to the implementation problems as well as the 
shortcomings of these solutions. 

Finally, the conclusion is reached that there are ways 
to improve the process, such as improving direction and 
coordination in the Act's implementation, emphasizing 
alternatives to internal control reviews, focusing efforts 
on high risk areas, improving management training and using 
a checklist approach to completing the required reviews. 
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The research consisted of telephone interviews to 
solicit any innovative ideas to improve implementation of 
the Act. In addition, a detailed search and evaluation was 
made of the literature in the area of internal control 
systems and the GAO audits of the Navy's progress in 
implementation of the Act. 

D. ORGANIZATION OF THESIS CHAPTERS 

Chapter II provides a discussion on the background of 
the Federal Government's internal control system. This 
includes a discussion of the Budget and Accounting Act of 
1950, OHB Circular A-123, the FMFIA, and the GAO standards 
for internal controls in the Federal Government. 

Chapter III examines the internal control evaluation 
system. This chapter covers the DOD internal control 

evaluation process, including performing vulnerability 

assessments and management control reviews. 

Chapter IV details the history of the Navy's Internal 
Control Program, the Navy's financial management structure 
and accounting systems weaknesses, and covers the 

implementation problems the Navy has experienced in 
implementing their internal control program. 

Chapter V details the Navy's implementation problems 
solutions and the shortcomings of those solutions. 

Chapter VI provides a summary along with some 

conclusions about and recommendations for further 

implementation of the FMFIA. 
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II. INTERNAL CONTROL IN THE FEDERAL GOVERNMENT 



A. BUDGET AND ACCOUNTING ACT OF 1950 

The Budget and Accounting Act was passed in 1950 and 
required that each agency head establish and maintain 
systems of accounting and internal control. The passage of 
the produced high expectations that these systems of 
accounting and internal control would help reduce or prevent 
fraud, waste, abuse and mismanagement in Federal Government 
operations. Unfortunately, development of effective systems 
has been slow and numerous situations continue to appear in 
the news headlines which show lack of fiscal responsibility, 
such as instances of fraud, waste and abuse continue to 
occur at unacceptable levels. 

B. OFFICE OF MANAGEMENT AND BUDGET CIRCULAR A-123 

One reason given for the ineffectiveness of the Budget 
and Accounting Act was its lack of enforcement. Although 
the Act was understood as the current standards of internal 
standards of internal control, it did not provide specific 
guidance on internal control systems or require mandatory 
reports on the quality of those systems. 

To give the Act more teeth, OMB issued Circular A-123 
in October 1981 as an early effort to improve controls. The 
Circular required the head of each department and agency to 
develop and maintain adequate systems of internal control. 
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Unlike the 1950 Act, however, it defined requirements and 
responsibilities in order to transform the 1950 Act's 
expectations and enforcement into reality. 

The purpose of A-123 is to prescribe policies and 
procedures to be followed by executive departments and 
agencies in establishing, maintaining, evaluating, 
improving, and reporting on internal controls in their 
program and admi n istrat i ve activities (ref. l:p.l). 

Congress also saw the need for effective internal 
management in the Federal Government. The pressure for 
Congress to act to force improvement in the government 
agencies' internal management was fueled by the numerous 
headlines of fraud, waste and abuse in federal activities 
and programs, eroding public conf idence , and the government's 
inability to operate effectively. Continuing concern over 
the poor condition of government internal control and 
accounting systems led the Congress to pass the Federal 
Managers' Financial Integrity Act of 1982 (P.L. 97-255). 



C. FEDERAL MANAGERS' FINANCIAL INTEGRITY ACT OF 1982 

This Act requires that agency heads annually report to 

the President and the Congress as to whether their internal 

accounting and administrative control systems comply with 

the Comptroller General's internal control standards and 

provide reasonable assurance that: 

obligations and costs are in compliance with applicable 
law; 
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funds, property and other assets are sa f eguarded ;and 

— revenues and expenditures are properly recorded and 
accounted for (ref. 2:p.2). 

The Act requires that each agency evaluate its internal 
control system in accordance with guidelines prescribed by 
OMB and report annually any material internal control 
weaknesses together with plans for correction. The annual 
report must also indicate whether or not the agency's 
accounting system conforms to the Comptroller General's 
accounting requirements. 

The Act directed that the evaluation and reporting 
requirements be implemented in two steps. The first step 
was the preparation of guidelines for the evaluation of 
internal and administrative controls by OMB in consultation 
with the Comptroller General by December 31,1982. The second 
step required commencement of annual reporting by the 
agencies by December 31, 1983. 



D. STANDARDS FOR INTERNAL CONTROLS IN THE FEDERAL GOVERMENT 
To satisfy the first step, it was necessary to define 
what was meant by internal control. The American Institute 
of Certified Public Accountants (AICPA) has made a 
distinction between internal accounting controls and 

administrative controls. Administrative controls are 

concerned with the decision processes leading to 
management's authorization of transactions. This 
authorization is the starting point for establishing 
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internal accounting control of transactions. Internal 
accounting controls are concerned with safeguarding of 
assets and reliability of financial records. Given 
the AICPA definitions of administrative and internal 
accounting controls, the Federal Government needed to 
develop standards for internal controls. OMB requested GAO 
to develop these standards. GAO reponded by publishing 
STANDARDS FOR INTERNAL CONTROLS IN THE FEDERAL GOVERNMENT in 
1983. This document, which has come to be known as the 
"green book" was derived from the professional standards 
established by the AICPA and includes the following concept 
of internal controls which is useful in understanding and 
applying the internal control standards: "The plan of 
organization and methods and procedures adopted by 
management to ensure that resource use is consistent with 
laws, regulations and policies; that resources are 
safeguarded against waste, loss, and misuse; and that 
reliable data are obtained, maintained, and fairly disclosed 
in reports." (ref. 3:p.l) 

What is an internal control standard? GAO defines it as: 
"the minimum level of quality acceptable for internal 
control systems in operation and constitute the criteria 
against which systems are to be evaluated." (ref.3:p.2) The 
definition adds that these standards apply to all functional 
areas, not the financial or accounting areas. Each area 
has some inherent internal controls in the form of 
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instructions mission and performance requirements and 
program objectives. 

The "green book" breaks the standards for internal 
control into three areas: general standards, specific 

standards, and the audit resolution standard. 

1 . General Standards o f I nternal Control 

GAO lists five general standards of internal 
control which apply to all aspects of internal controls, 
a. Reasonable Assurance 

"Internal control systems are to provide 
reasonable assurance that the objectives of the systems will 
be accompl ished . " ( re f . 3 : p . 4 ) The term "reasonable assurance" 
is inherently subjective, difficult to define and requires 
judgment to be exercised. The concept of reasonable 
assurance recognizes that internal controls must be cost- 
beneficial. That is, the cost of internal control should not 
exceed the benefit derived. A cost here refers to the 
financial measure of resources consumed in accomplishing a 
specified purpose. The benefit derived from a control refers 
to the reduction in risk from failing to achieve the 
objective of the control. Because the benefit is often not 
precisely quantifiable, it is more difficult to define and 
determine, and decisions must depend on estimates and 
judgments by management. To increase the amount of control 
in an area usually will result in an increase in cost. 
Therefore, the judgment required to be performed with each 
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control is whether the cost of the control exceeds the 
benefits derived. 

b. Supportive Attitude 

"Managers and employees are to maintain and 
demonstrate a positive and supportive attitude toward 
internal controls at all times." (ref.3:p.4) Line management 
commitment to achieving effective internal controls is vital 
to the success of achieving the intent of this standard. 
This standard requires agency managers and employees to be 
attentive to internal control matters and to take steps to 
promote the effectiveness of the controls. The bottom line 
here is that overall leadership is critical to maintaining a 
positive and supportive attitude toward internal controls. 
This is accomplished through training, motivating employees 
and encouraging management improvement suggestions. 

c. Competent Personnel 

"Managers and employees are to have personal 
and professional integrity and are to maintain a level of 
competence that allows them to accomplish their assigned 
duties, as well as understand the importance of developing 
and implementing good internal controls." (ref. 3:p.5) 
Managers and their staffs are required to maintain and 
demonstrate their personal and professional integrity, a 
skill level necessary to ensure effective performance and a 
sufficient understanding of internal controls to effectively 
discharge their responsibilities. Professional integrity 
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can be promoted or strengthened through an operative code of 
conduct. In addition, staffing decisions should include 
verification of minimum education and skill requirements. 
In the Federal Government this is a severe 
limitation. Therefore, training programs are required. 
Performance appraisals should also include an assessment of 
the manager's implementation and maintenance of effective 
internal controls. Managers who possess a good 

understanding of internal controls are vital to effective 
control systems, and these managers should be used in 
formal and on-the-job training programs, 
d. Control Objectives 

"Internal Control objectives are to be 
identified or developed for each agency activity and 
are to be logical, applicable, and reasonably complete." 
(ref.3:p.6) The purpose of this standard is that the 
control objectives are tailored to the agency for each 
of its operations. Usually, all operations of an agency 
are grouped into cycles that are compatible with the 
agency's division of responsibilities. Some agencies collect 
cash, others do not; some pay out cash; some are more 

administrative in nature; and some are more program and less 
financially oriented. Examples of cycles include financial, 
administrative, agency management and program (operational) 
cycles. These cycles interact and controls over their 
interaction must be es tabl i shed . To comply with this 
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standard, an agency must identify and analyze each cycle to 
determine the internal control objectives. These objectives 
can then be used to evaluate the agency's internal controls, 
e. Control Techniques 

"Internal control techniques are to be 
effective and efficient in accomplishing their internal 
control objectives." (ref.3:p,7) The final general standard 
requires that the techniques of control are effective and 
efficient. Internal control techniques are the mechanisms by 
which control objectives are achieved. These techniques are 
policies, procedures, organizational plans and physical 
layouts. Control techniques must insure that the objective 
is met with a high degree of assurance within cost 
limitations. All control techniques should be reviewed 
periodically and evaluated as to their effectiveness and 
efficiency and be modified as required. Effectiveness means 
that the techniques fulfill their intended purpose. 
Efficiency means that the techniques are designed to provide 
maximum benefit with minimum effort. For example, adding 
more personnel to the internal control process may improve 
the effectiveness of techniques but not necessarily the 
e f f i c ie ncy . 

2 • Spec i f ic Standards o f I nter nal Control 

A number of techniques are essential to providing 
the greatest assurance that the internal control objectives 
are achieved. There are six critical specific standards. 
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Documentation 



a . 

"Internal control systems and all transactions 
and other significant events are to be clearly documented, 
and the documentation is to be readily available for 
examination." (ref.3:p.8) Basically, this standard requires 
that agencies document their internal control objectives, 
techniques and accountability systems and also document all 
pertinent aspects of transactions and other significant 
events of an agency. This documentation can be in a variety 
of forms, including policy manuals, management directives or 
flowcharts of transactions. Complying with the documentation 
standard requires that the documentation of internal control 
systems and transactions and other significant events be 
purposeful and useful to managers in controlling their 
operations and also provides auditors with a guide for their 
review. 

b. Recording of Transactions and Events 

"Transactions and other significant events are 
to be promptly recorded and properly classified." 
(ref.3:p.9) This standard applies to the entire life 
cycle of a transaction and includes initiation and 
authorization, all aspects of the transaction while in 
process and its final classification in summary records. 
This standard also provides management with the information 
it needs to control operations and provides summary records 
from which reports are prepared and for internal review and 



21 



audits. Failure to adhere to this standard can result in a 



loss of information if transactions are not recorded or are 
misclass i f ied . Also, if the information is untimely the 
agency’s reports can be erroneous. 

c. Execution of Transactions and Events 

’’Transactions and other significant events are 

to be authorized and executed only by persons acting within 
the scope of their authority.” (ref.3:p.9) The purpose of 
this standard is to assure that only valid transactions and 
other events are entered into. Organizations must have clear 
lines of authority for certain decisions such as cash 
payments. Independent evidence should be maintained so that 
proper authorizations are issued and so that the 
transactions conform with the terms of the authorizations. 
Authorization must be clearly understood by all persons 
concerned and specific conditions of authorization must be 
clear to ensure compliance with this standard. 

d. Separation of Duties 

’’Key duties and responsibilities in 
authorizing, processing, recording, and reviewing 
transactions should be separated among individuals.” 
(ref.3:p.l0) No one individual should control all key 
aspects of a transaction or event. The primary factor for 
deciding when to separate duties is if the performance of 
duties by one person would allow that person to commit fraud 
or abuse the system. Duties and responsibilities should be 
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assigned to a number of individuals to ensure effective 
checks and balances exist. One major area to watch in this 
area is collusion, because collusion can reduce or destroy 
the effectiveness of this standard. Unf or tuna te ly , col lus i on 
is very hard to discover since it involves two or more 
individuals. 

e . Superv is i on 

"Qualified and continuous supervision is to be 
provided to ensure that internal control objectives are 
achieved." (ref.3:p.l0) This requires supervisors to 
continuously monitor the work of their employees and ensure 
they receive proper training and direction. The assignment, 
review and approval of employees' work includes 
communicating the duties and responsibilities clearly, 
periodic review of performance and approval of work at 
critical points to ensure timely completion. This standard 
ties together internal controls and can prevent weaknesses 
such as collusion from occurring. Supervision is a subset of 
operational control and is generally concerned with the day 
to day operations of the organization. Hautz and White say 
supervision is designed to provide reasonable assurance 
that employees utilize and conserve the activity's 
resources and do not undertake actions detrimental to the 
accomplishment of stated objectives ( ref . 4 : p . 15 ) . The process 
involves managers who get things done by working with 
others instead of continuously monitoring personnel actions. 



23 



f. Access to and Accountability for Resources 

" Access to resources and records is to be 
limited to authorized individuals, and accountab i 1 i ty for 
the custody and use of resources is to be assigned and 
maintained. Periodic comparison shall be made of the 
resources with the recorded accountability to determine 
whether the two agree. The frequency of the comparison 
shall be a function of the vulnerability of the asset." 
(ref.3:p.ll) The basic concept behind this standard is to 
restrict access to resources. This will help reduce the 
tisk of fraud, waste or abuse of assets. Some assets, (e .g. , 
cash and pilferable material) are more vulnerable to fraud, 
waste or abuse than others. This is because of factors such 
as cost, portability, exchangeability, and the perceived 
risk of loss or improper use of the resources. Each agency 
must evaluate its resources and establish control 
commensurate with these factors that provide reasonable 
assurance that these resources are safeguarded. 

3 . Aud i t Resolution Standard 

a. Prompt resolution of audit findings 

"Managers are to promptly evaluate findings and 
recommendations reported by auditors, determine proper 
actions in response to audit findings and recommendations, 
and complete, within established timeframes, all actions 
that correct or otherwise resolve the matters brought to 
management's attention." (ref.3:p.l2) 



The process of resolving audit findings begins when 
the audit results are presented to management and is 
completed when actions have been taken to correct the 
identifed deficiencies, produce improvements or demonstrate 
the audit findings are either invalid or do not warrant 
management action. 

E. CONCLUSION 

The implementation of the Federal Managers' Financial 
Integrity Act, OMB Circular A-123 and the GAO Standards for 
Internal Controls in the Federal Government has been 
progressing, although not as quickly as was expected. 
However, the requirement for implementation and evaluation of 
these controls is real. 

The standards for internal control must be understood 
by the personnel implementing and evaluating these systems. 
Nevertheless, these are broad guidelines which management 
must tailor to meet its own specific organization. 

Based on our discussion of the standards of internal 
in the Federal Government, we will next discuss the system 



of internal control 


evaluation 


the Navy 


is using 


to 


implement the Federal 


Managers ' 


Financial 


Integrity Act 


of 


1982 and to comply with 


the requirements of 


the Act . 
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I 1 1. OVER VIEW OF THE INTERNAL CONTROL EVALUATION SYSTEM 



A. INTRODUCTION 

Once Congress passed the Federal Managers' Financial 
Integrity Act of 1982, it became a requirement for each 
agency to conduct evaluations of their systems of internal 
control. OMB developed and revised Circular A-123 to issue 
guidelines for the evaluation of internal controls. These 
guidelines have been expanded to include not only accounting 
controls but also administrative controls. 

Accounting controls safeguard assets and assure 
reliability of the financial records. Accounting controls 
in one form or another are also employed in other 
nonfinancial functions (e.g., supply, personnel and property 
management). Administrative controls provide the 
organizational structure, policies and procedures through 
which goals and missions are achieved and coordination is 
maintained. They are designed to assure adherence to 
applicable regulations and policies. The Department of 
Defense (DOD) and the Department of the Navy have used the 
OMB guidance in developing the system currently used to 
evaluate internal controls in their agencies. 

The entire internal control evaluation process must be 
understood before one can do evaluations and analyze the 
results. An eight element internal management control 
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program must be developed by each DOD component in 
accordance' with DOD Directive 5010. 38A ( ref . 5 : p. 4 ) . The 

eight elements are: 

1. Organizing the internal management control process 

2. Segmenting the components into assessable units 

3. Conducting vulnerabilty assessments on those units 

4. Developing plans for subsequent action 

5. Conducting internal management control reviews or 
other appropriate management actions 

6. Scheduling and taking corrective action 

7. Providing for quality control 

8. Preparing reports. 

This chapter will focus on this process. 

B. ORGANIZING THE PROCESS 

One of the most critical aspects of the entire internal 
control process is organizing the evaluation process. 
Organizing the internal management control process includes 
assigning responsibilities and providing personnel for 
planning, directing, and controlling the program; developing 
internal reporting and tracking capabilities; maintaining 
documentation; and scheduling evaluations. This organization 
effort provides the framework that ensures that evaluation 
improvement and reporting on internal controls is conducted 
efficiently and effectively. 
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Assigning Responsibilities 



1 . 

The head of the agency is required to submit a 
statement on the status of the agency's internal controls. 
However, the preparation of this statement must be delegated 
down to senior agency officials to ensure that the process 
of evaluating and reporting on internal controls is in 
accordance with promulgated guidelines. These senior 
officials are charged with the responsibility to provide the 
agency head with written assurances that the program was 
carried out in an efficient and effective manner. 

The assignment of responsibilities should include 
one senior official to oversee the entire process. This 
senior official oversees the or gan i zat i onal units and these 
in turn oversee the heads of individual activities. This 
process should be organized down to the lowest level of 
responsibility that is feasible for the efficient operation 
of the process. 

In addition,the Inspector General, internal audit or 
internal review personnel can be of great help in the 
organizing process to reduce or prevent duplication of 
effort. 

2 . Providing Personnel for the Pr ogram 

It is essential that a sufficient level of staff 
support and resources be committed to the process for 
planning, directing, and controlling. It is highly likely 
that most of these personnel will have little or no 
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experience in evaluating internal controls. Therefore, it is 
essential that, if the process is to be successful, some 
specific measures are considered such as orientation 
and training, supervision, technical assistance, monitoring 
to assure the reviews are performed adequately, and 
individual appraisal of their performance. Personnel 
involved in the process should be advised that this will be 
a factor in their overall performance evaluation. 

3. Developing Internal Reporting and Track i nq 

Capabilities 

An internal reporting and tracking system must be 
established to ensure that the evaluation process is 
performed in a timely manner. The system at a minimum 
should include reporting and tracking of vulnerability 
assessments, internal management control reviews and, most 
importantly, corrective actions to be taken on a timely 
basis. The system should also be able to provide information 
to support preparation of the agency's required annual 
statement and the gathering of information on actions 
necessary to improve internal controls. 

4 . Ma i nta i n inq Documentation 

Adequate documentation must be maintained. All 
documentation connected with the process of conducting 
vulnerability assessments, internal management control 
reviews and follow-up action should be kept to provide a 
record on what was done and who performed the duties. This 
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information will also be valuable for reviewing the validity 
of conclusions reached, evaluation of performance of 

individuals performing the reviews and an audit trail for 
future assessments. 

5 . Scheduling Evaluations 

The scheduling of evaluations is driven by the 
Circular A-123 requirements. The process should be scheduled 
to insure that all reviews are completed in time to support 
the preparation of the agency's annual statement. In 

completing the requirement, items such as the cyclical 
nature of operations, availability of personnel and resource 
availability should be taken into account. 

C. SEGMENTING THE AGENCY 

DOD guidance requires that inventories of assessable 
units shall be established by segmenting the component into 
or gani zat i onal , functional, programmatic, or other 

appropriate subdivisions suitable for evaluating systems of 
internal management controls, and identifying program and 
admin istrat i ve activities of appropriate nature and size to 
facilitate a meaningful assessment. The resulting listing of 
assessable units shall be reviewed annually for changes. 

In developing the listing of assessable units, 
reference should be made to sources of information such as 
organization charts, procedure manuals, the agency’s budget, 
and program management information systems. 
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Two 



important factors 



should be considered 



when 



segmenting the agency. First, the segmentation should 
include the lowest level of responsibility feasible. Second, 
segmentation of the agency must provide for the systematic 
evaluation and reporting of internal control systems. 

D. CONDUCTING VULNERABILITY ASSESSMENTS 

A vulnerability assessment is a review of the 
susceptibility of all the programs listed in the 
segmentation process to the occurrence of waste, loss, 
unauthorized use or misappropriation. The vulnerability 



assessments 


do not identify or evaluate the effectiveness 


of internal 
loss . 


controls; they only establish the potential for 


Each 


agency conducts its own vulnerability 


assessments 


They are performed by all levels of management 


including 


the lowest possible responsible level as 



determined by the segmentation process. 

The vulnerability assessment consists of three 
steps: (1) analysis of the general control environment, (2) 
analysis of inherent risk, and (3) preliminary evaluation of 



s a f eguards . 


Completion of these three steps is then 


summar ized , 


allowing the assessor to make an overall 


assessment 


of the units. The three steps of a vulnerability 



assessment will be covered below. 
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1 . 



Analys is o£ the Genera 1 Control Environment 
The environment of an activity has a major influence 
on the vulnerability of a program. There are several factors 
which influence the environment, including: 

- Management Attitude - Management recognition of the 
importance of and commitment to the establishment 
and maintenance of a strong system of internal control 
as communicated to employees through actions and words. 

- Organizat ional Structure - The identification of 
organizational units to perform the necessary functions 
and the establishment of appropriate reporting 

relationships . 

- Personne 1 - The competence and integrity of the 

organi zat ion 1 s personnel. 

- Delegation and Commun icat ion o f Author i ty and 
Responsibility - Appropriate delegation or limitation of 
authority in a manner that provides assurance that 
responsibilities are effectively discharged. 

- Policies and Procedures -The definition, documentation 
and dissemination of information to ail employees as 
to how the organization is intended to perform in 
various situations. 

- Budget i nq and Report i nq P ract ices - The 
and communication of organ i zat i onal 
extent of their accomplishment. 

- Organizational Checks and Balances - The establishment 
of an appropriate level of financial and other 
management controls and internal auditing. 

- Automated Data Process ing ( ADP ) Consideration - When 
utilized, an awareness of the strengths and exposures 
inherent in a system that uses ADP and the existence of 
appropriate controls. 

The analysis of the general control environment 
should be performed throughout the agency. It is the first 
step in the vulnerability assessment process. The analysis 
can be performed either as a whole or individually for each 



spec i f ica t i on 
goals and the 
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component. It should be performed by determining whether or 
not the characteristics of a strong control environment 
exists by reviewing policies and procedures, interviewing 
appropriate management personnel, observing daily practices 
and by gaining a familiarity with the operations. 

2 . Analysis of I nherent Risk 

The second step in the vulnerability assessment 
process is to perform an analysis of the inherent potential 
risk for waste, loss, unauthorized use or misappropriation 
due to the nature of the activity. This assessment is 
performed to determine those programs with higher risk as 
those programs generally require more control. Some factors 
to be considered in performing this analysis are: 

- Purpose and character ist ics of the program 

- Budget level allocated to the program 

- Impact of the program outside the agency 

- Age and expected life of the program 

- The degree of centralization of the program 

- Special concerns of the program 

- Prior reviews of the program 

- Management responsiveness within the program 

3 . Preliminary Evaluation of Sa f eguards 

The third step in the vulnerability assessment 
process is the making of a preliminary evaluation by the 
reviewer on the existence and adequacy of internal controls 
over the programs. An important consideration is whether 
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adequate controls are in place to minimize or prevent 
waste, loss unauthorized use,or misappropriation. This is 
not an in-depth review of internal controls, but an 
assessmenmt by the reviewer of the existence and functioning 
of current controls. 

4 . Summar izinq the Results of the Vulnerabi 1 i ty 
Assessments 

After completing the three steps of the 
vulnerability assessment process, the reviewer can summarize 
the results and make an overall assessment of the adherence 
of the program’s internal control system to the prescribed 
standards and the vulnerability of the program to 
waste, loss, unauthorized use, or misappropr iat ion . This 
information allows management to develop a plan for 
conducting the internal control review process. 

E. CONDUCTING INTERNAL MANAGEMENT CONTROL REVIEWS 

Once the vulnerability assessments have been completed 
and summarized, plans and schedules for internal management 
control reviews or other actions shall be developed based on 
a ranking of the assessable units* vulnerability. 

An internal management control review is a detailed 
examination of an assessable unit to ensure internal 
controls exist, are in place, documented and functioning as 
intended. These in-depth reviews should identify weak, non- 
existent or excessive controls and initiate actions 
necessary to correct them. 



34 



Internal management control reviews shall include the 
following six steps: 

1. Identification of event cycles 

2. Analysis of the general control environment 

3. Docume ntat i on of the event cycles 

4. Evaluation of internal controls within the event cycles 

5. Testing the internal controls 

6. Reporting the results. 

1. Identi f ication of Event Cycles 

The first step of this process breaks down each 
program into their respective event cycles. An event cycle 
is basically a series of related steps within a program that 
are held together by significant beginning and end points. 
Generally accepted auditing standards usually segment event 
cycles into the following categories: sales and collections, 
acquisition and payment, payroll and personnel, inventory 
and warehousing and capital acquisition and repayment. Most 
programs have many event cycles and each event cycle 
represents an area that should be examined for internal 
controls. An example of an event cycle for administration 
would be a payroll department. The cycle begins with proper 
authorization of employment, pay computed using only valid 
time cards, proper withholding of taxes, segregation of 
duties for personnel processing checks and those 

distributing them. Another example of an event cycle within 
an activity publishing directives would include gathering 



35 



information, writing a draft, transcribing editing 
circulating for comments, revising, transcribing in final 
format, publishing, distributing and updating. Once all the 
events for a particular program are identified, a 
determination is made as to their vulnerability to risk. The 
source of information for this is the results of the 
vulnerability assessments. The judgment of the person 
performing the review can also be used. It is important to 
maintain all documentation relating to this process to 
provide future reviewers with an audit trail. 

2 . Review of the General Control Environment 

The environment in which the event cycle operates 
has a major impact on the effectiveness of internal 
controls. An important part of the internal management 
control review is an evaluation of the general control 
environment listed earlier. Analysis of the general control 
environment performed for the vulnerability assessment can 
be used for this process but should be updated or modified 
as r equ i r ed . 

3 . Documentat i on of the Event Cycles 

The reviewer of an event cycle must thoroughly 
understand each part of the event cycle. This understanding 
is accomplished through completely documenting the cycle. 
This is particularly important when the person preparing the 
documenta t i on is not the reviewer. The documentation can be 
in the form of a narrative description or a flowchart with a 
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narrative description. Documenting the event cycle is 
accomplished through reviewing past documentation and 
interviewing personnel involved in the cycle. The 
documentation should include such things as procedures 
followed, interviewing personnel performing the procedures 
and examining the forms and records developed and 
maintained. Additionally, the reviewer should examine the 
documentation with personnel involved in the cycle to ensure 
it accurately reflects the cycle correctly. Also a small 
number of transactions may be traced through the cycle. Both 
of these procedures will ensure the documentation and the 
understanding of the event cycle are accurate. 

4 . Evaluation of I nte rna 1 Management Controls 

The fourth step in the internal management control 
process is to evaluate the event cycle by using the 
documentation. This evaluation should help the reviewer 
decide if the internal control system is sufficient to 
provide reasonable assurance against waste, loss, 
unauthorized use or misappropriation. This evaluation can 
also determine whether the internal control system meets the 
requirements of the Federal Managers' Financial Integrity 
Act and OMB Circular A-123. 

The manner in which this is done is to first 
ascertain the control objectives for the event cycle. If the 
control objectives are achieved, the potential for the 
occurrence of waste, loss, unauthorized use or 
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misappropriation is significantly decreased. Next, the 
control objectives for an event cycle should be written. 
This documentation should be reviewed to determine whether 
the list of objectives for each cycle is complete, logical, 
and relevant to the event cycle. If the control objectives 
are not adequately documented, such documentation should 
be developed and maintained as part of the overall 
documentation of internal controls. Third, the relationship 
between this, the prior task, and the inherent risks in an 
event cycle cannot be overemphasized. Control objectives 
are established because a risk of loss exists; internal 
management control techniques are implemented to prevent the 
specific loss from occurring. 

Another important area during this step is to 
identify whether there are any internal control techniques 
that are excessive, thereby creating inefficiencies and 
unnecessary costs. 

The final results of this process should identify 
those internal controls which require testing, the absence of 
controls that should be corrected, control objectives for 
which control techniques are not adequate and system 
corrections that must be made and control techniques that 
are unnecessary and can be eliminated. 

5 . Testing o f Internal Controls 

This is the final step in the review process and is 
used to evaluate if the controls are functioning as 
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required. This step is similar to an auditor's compliance 
test. It may be done by selecting a sample of transactions 
and reviewing the documentation for those transactions 
to determine compliance with the related internal control. 
In addition, observing the controls functioning and 
interviewing personnel involved can be extremely useful. 
If control techniques are not functioning properly, the 
reviewer should evaluate if there is a compensating 
control. The reviewer should note any other techniques which 
might also compensate for the control in question. The 
review should provide documentation for any control 
weaknesses that were uncovered and possible corrective 
actions for the weaknesses. 

6 . Reporting the Results of I nter na 1 Management Control 

Reviews 

After completing the internal management control 
reviews, the results are summarized and reported on. Two 
types of reports are prepared. The first report provides 
management of the program information concerning the 
internal control weaknesses within the system and possible 
corrections. The first report includes material weaknesses 
in internal accounting and administrative controls and a 
schedule for their correction. Also, material weaknesses 
identified and corrected during the year are included in the 
first report as accomplishments. The first report is 
basically an internal document to be used by the individual 
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command to correct any identified weaknesses. Any 
recommendations to improve the efficiency and effectiveness 
of the program should be included. The second report 
contains a listing identifying material weaknesses in 
internal accounting and administrative control of 
significance to the President and the Congress, and gives 
the agency head the required information necessary to 
support the agency head's statement. The second report must 
be made available to the public unless there is an area of 
the report that is judged to be classified. 

F. SCHEDULING AND TAKING CORRECTIVE ACTIONS 

DOD Directive 5010. 38A requires that a formal follow-up 
system be established to record and track internal 
management control deficiencies from any source, schedule 
corrective actions with completion dates, and provide 
assistance for the development of plans for implementation 
of the corrections. The recommended corrective actions of 
the internal control reviews should be reviewed for possible 
implementation on a timely basis by the functional area 
managers. Although no specific penalties are levied for not 
taking corrective actions, the administrat ive controls of an 
activity, if properly functioning, generally have an effect 
on employee awareness of individual responsibility and 
provide some sort of assurance that the failure to perform 
assigned procedures will result in appropriate disciplinary 
action. 



40 



G. QUALITY CONTROL 

OPNAVINST 5200. 25A (ref.6:p.4) requires that quality 

control shall be exercised at all levels oE command to 
ensure that the objectives of this program are achieved. 
Specifically, Navy activities are required to: 

1. Ensure internal control training is provided 

2. Vulnerability assessments and management control 
reviews are performed adequately 

3. Required reports are prepared accurately and 
submitted on time 

4. Establish a formal follow-up system for monitoring 
actions to significant and/or systemic weaknesses 

5. Establish a system of testing corrective actions to 
significant and/or systemic weaknesses. 

H. CONCLUSION 

The process of evaluating internal control systems has 
been explained in this chapter. Personnel who have received 
training in internal management control reviews should be 
able to implement this system. However, the Navy has not 
been completely successful in implementing this process. The 
implementation problems encountered by the Navy and the 
solutions the Navy has come up with to solve these problems 
will be covered in the next chapters. 
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IV. INTERNAL CONTROL PROGRAM IN THE DEPARTMENT OF THE NAVY 



A. HISTORY OF THE NAVY'S INTERNAL CONTROL PROGRAM 

Once the OMB Circular A-123 and DOD guidelines were 
issued, it was up to the DON to implement an internal 
control program of their own to satisfy the requirements of 
the FMFIA. 

The Navy's first internal control instruction, 
SECNAVINST 5200.35, I nter na 1 Control in the Department of 
the Navy, was issued on 29 July 1983. This instruction 
incorporated the original versions of Circular A-123 and DOD 
guidance, as well as the FMFIA within DON. The instruction 
also established the Navy's own program to develop, 
maintain, review and improve internal control systems to 
ensure resources are efficiently and effectively managed. 
In addition, procedures for vulnerability assessments and 
management control reviews were provided. 

The initial responsibility for implementing the 
program was assigned to the Office of the Assistant 
Secretary of the Navy for Financial Management (ASN (FM)). 
One problem with this first instruction was that there was 
no central focal point for the Chief of Naval Operations' 
( CNO ) office to coordinate subordinate commands inputs. This 
led to some confusion by Naval activities on exactly how to 
implement the program at the local level because of no 
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detailed guidance from the CNO level. In fact, it was not 
until almost two years later in 1985, at the insistence of 
the ASN(FM), that the C NO established an office and assigned 
responsibility for the Navy's internal control program. The 
role of the CNO ' s office is explained below. 

The SECNAVINST was updated and reissued on 17 May 1985. 
This revision provided updated fundamental policy guidance 
and the basic management philosophy of the DON Internal 
Control Program. 

The CNO and the ASN ( FM ) have different roles with 
regard to the program. The role of the CNO's office is 
detailed in OPNAVINST 5200. 25A (ref.6:p.5). This instruction 
was issued 6 January 1986 and assigns responsibility for the 
Navy's Internal Control Program to the Assistant Vice Chief 
of Naval Operations (AVCNO) (OP-09B). The AVCNO provides the 
ASN (FM) with reports and statements required to satisfy the 
requirements of the FMFIA. The AVCNO is also responsible for 
promulgating field guidance, developing procedures, 
establishing reporting requirements, maintaining an 
assessable unit inventory, monitoring compliance, directing 
management control reviews, following up on specific 
weaknesses assigning responsibility for correction of Navy- 
wide specific, significant and systemic weaknesses, 
evaluating corrective actions and coordinating all training 
requirements relating to the internal control program. 
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The ASN ( FM ) role, under the OEEice o£ the Comptroller 
of the Navy (NAVCOMPT), is really twofold. First, NAVCOMPT 
is responsible for the maintenance of their internal control 
policy instruction on internal control and preparation of 
NAVCOMPT reports based on input from NAVCOMPT components on 
the status of the Navy's accounting systems internal 
controls. More importantly, NAVCOMPT is responsible for 
writing the Secretary of the Navy's annual compliance 
statement to the Secretary of Defense by consolidating all 
upper echelon DON commands such as CNO, Commandant of the 
Marine Corps and all the Secretariat level offices' annual 
compliance statements. In preparing the Secretary of the 
Navy's annual statement, NAVCOMPT extracts all material 
weaknesses that have Navy-wide application from the 
individual compliance statements they receive. 

B. FINANCIAL ORGANIZATION STRUCTURE OF THE NAVY 

DON is a large decentralized organization that 
accomplishes its mission through the use of a chain of 
command . 

The financial management organization structure within 
DON has at its head the Assistant Secretary of the Navy for 
Financial Management (ASN (FM)). The ASN (FM) is responsible 
for all matters related to the financial management of the 
DON including budgeting, accounting, disbursing, financing, 
progress and statistical reporting and auditing. Hence, the 
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ASN (FM) is the Navy's chief of accounting information 
systems . 

The DON has fourteen major accounting systems that meet 
the GAO definition of adequate accounting systems. 
Currently, only one of these systems is in compliance with 
the DOD Accounting Manual procedures. For example, the 
Navy's pay and disbursing system (JUMPS) was disapproved by 
GAO because there were too many errors in the system. 

The Navy recognizes that there are major deficiencies in 
its accounting systems. However, the Navy does have a plan to 
bring all its accounting systems into substantial compliance 
with prescribed OMB and Comptroller General principles and 
standards. This plan is called the DON Strategic Financial 
Management Master Plan and details the systems, deficiencies 
and corrective actions. 

Some of the major deficiencies identified in the Navy's 
accounting systems through the management control review 
process include: 

1. Data inaccuracy and incompleteness 

2. Information does not meet user needs 

3. System is not under full general ledger control 

4. Systems do not have adequate internal controls 

5. Systems are inefficient, labor intensive and costly 

6. Systems do not have adequate audit trails 

7. There is no uniform chart of accounts 
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Each of these deficiencies cause Navy managers problems 
in trying' to analyze their operations and deciding how to 
control, conserve, protect and use their resources. 

The FMFIA has made the Navy focus on getting their 
accounting systems in order since each accounting system 
must be reviewed and identified deficiencies corrected. One 
of the major reasons the Navy felt that they needed to get 
their accounting systems in order are the possible 
consequences of reporting the accounting systems as 
deficient. The possible consequences or penalties of 
reporting deficiences are the budget implications and strong 
managerial leverage that can be applied. There have been 
recent efforts to reduce the Navy's budget because of 
internal control weaknesses. 

C. EFFECT OF THE FEDERAL MANAGER'S FINANCIAL INTEGRITY ACT 

The major effect of the FMFIA on the DON was to provide 
the Navy with a significant impetus to improve management 
control and accountability by focusing attention on system 
problems. To this end the FMFIA has shown some success and 
the Navy has demonstrated a commitment to strengthen its 
sys terns . 

However, the initial Navy reaction to the FMFIA and the 
internal control program was negative. There was significant 
resistance by management when tasked to perform 
vulnerability assessments and management control reviews. A 
number of managers felt that the program was requiring them 
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to do what auditors did, in that managers were in effect 
auditing themselves. This negative attitude toward the 
program by senior line managers was and still is a major 
stumbling block to effective implementation of the program. 

The positive aspects of the FMFIA are that first, the 
Navy has taken action to establish internal control 
evaluation procedures. Within the last two years, the DON 
has established and clarified a number of written procedures 
to guide activities in implementing a satisfactory internal 
control program. 

Second, the Navy has identified and corrected material 
weaknesses. Some of these weaknesses, however, are long- 
standing problems which take time to fully correct, and the 
solutions are not always easy. 

Third, as a result of the FMFIA, the Navy has also 
identified and corrected a number of weaknesses, which 
individually are not considered to be material in lost 
money, time, etc. However, these weaknesses usually involved 
failure to comply with established policies and procedures, 
and collectively are important since failure to correct 
these weaknesses could have a material effect if all items 
are considered. 

D. RESEARCH METHODS 

The information gathering for this thesis included 
review of the published GAO audits and other studies, plus 
DOD and DON instructions relevant to the internal control 
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program. In addition and more importantly, a telephone 
survey was conducted which asked the interviewees what kind 
of implementation problems they had experienced with regard 
to implementing the requirements of the FMFIA and internal 
control program at their organizational level. 

The interviewees consisted of personnel from the Office 
of the Navy Comptroller, the Navy Accounting and Finance 
Center, the Chief of Naval Operations, the Commander in 
Chief, U.S. Atlantic Fleet, the Commander Naval Surface 
Force, U.S. Atlantic Fleet, the Chief of Naval Education and 
Training and the Naval Audit Service. 

These commands were selected because each of them has a 
direct impact on the implementation process and most have 
subordinate commands to whom they provide internal control 
guidance . 

The telephone interviews were conducted with twelve 
individuals who had some responsibility for the internal 
control program at these activities. The procedure used 
during the interviews was to explore the history of the 
implementation process at their commands and then ask what 
specific implementation problems they had experienced with 
the program. Each implementation problem identified during 
the interviews was then further investigated to determine 
whether or not this problem appeared to be a Navy-wide 
problem. The interviewees were also asked what solutions to 
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their implementation problems they had arrived at and what 
improvements they would recommend. 

E. DON INTERNAL CONTROL PROGRAM IMPLEMENTATION PROBLEMS 

The internal management control review process 
previously described would seem to be a relatively simple 
process that, if followed carefully, would produce adequate 
results and satisfy the requirements of OMB Circular A-123 
and the FMFIA. Nevertheless, the Navy has experienced 
numerous implementation problems which have been the source 
of tremendous frustration for Navy managers. The first list 
of identified implementation problems are derived from 
published GAO reports (ref. 7) and a study completed by the 
President's Council on Management Improvement (ref. 8) and 
include : 

1. Paperwork and workload burden 

2. Inadequate basis for reporting 

3. No follow-up or tracking system for reporting 
corrected internal control deficiencies 

4. Accounting systems did not conform to GAO requirements 
Each of these areas will be examined more closely. 

1 . Paperwork and workload burden 

The President's Council on Management Improvement 
highlighted the paperwork and workload burden of the program 
in their October 1985 report (ref. 8:p.l). Two of the major 
findings from this report were that : 1) a substantial time 
and paper burden was created in the FMFIA' s implementation; 
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and 2) similar vulnerability assessment results could have 

been accomplished through a simpler process with less paper. 

In GAO’s December 1985 audit of the 
FMFIA (ref. 9 :p. 54) GAO wrote that a common concern 
surrounding the Act has centered on documentation of systems 
and the view that the evaluation process has become a 
burdensome paper exercise. Additionally, the House Committee 
on Government Operations expressed concern that some agency 
officials believed that implementation of the Act had 
accomplished little beyond adding to the paperwork burden. 
The Committee concluded that if managers adopt the view that 
the implementation process is merely a burdensome paper 
exercise, this attitude will hamper efforts to achieve 
substantial improvement in the management of the Federal 
Government . 

The President’s Council on Management Improvement 
report found that the vulnerability assessment process was 
the most frequently criticized process. They found that 
managers believed that this process was required to be 
performed too frequently. In addition, some managers thought 
the vulnerability assessment process could be done by 
relying on information produced from existing management 
control evaluation and reporting processes. 

Another major problem is staffing. Although the 
individual managers were responsible for reviewing their 
programs, there were no personnel billets identified to 
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coordinate the command programs or train the managers on the 
proper procedures. The Internal Control Program coordinators 
were generally found in the internal review organization or 
given to a junior officer as a collateral duty, and usually 
the program coordinators had no knowledge or experience 
in the area of internal control systems. 

2 . I nadequate basis for report i nq 

One problem the Navy has encountered during 
implementation is an inadequate basis for reporting their 
internal control systems as being in compliance with 
prescribed standards. The Navy did not know how general 
prescribed standards would apply to their operations and 
their systems that were under development. The GAO audit 
(ref. 9:p.35) reported that agencies did not know if 
controls were adequate because their internal control 

programs had not yet evolved to the point that they provided 
an adequate basis to determine that the Navy's systems of 
internal controls, taken as a whole, met the requirements of 
the Act. In addition, there had been difficulty in 
identifying systemic internal control problems. 

3 . No follow-up or tracking system for report i nq 
corrected interna 1 control de f ic ienc ies 

Another problem area noted by the GAO was that most 

Navy activities had not established required formal tracking 

and follow-up systems to monitor and ensure that internal 

control deficiencies were promptly corrected. GAO stated 
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that the Navy could progress significantly in its future 
FMFIA effort by implementing the required tracking and 
follow-up systems throughout the Navy (ref. 7:p.22 ). Two 
major reasons given for the lack of a system were no 
guidance on exactly how to set up a system and the reporting 
requirements under the system. Given the quality of the 
initial implementation guidance, these reasons appear valid. 

4 . Accounting systems did no t conform to GAO 

requirements 

As stated earlier, only one of the fourteen Navy 
accounting systems is in compliance with DOD Accounting 
Manual procedures. The GAO audit on the Navy's 
implementation progress (ref. 7 : p . 6 ) stated that the Navy 

did not evaluate and test in operation any of their 
accounting systems, did not adequately coordinate internal 
control reviews with accounting system evaluations, and had 
not established an adequate system to track accounting 
system deficiencies. 

F. RESULTS OF INTERVIEWS 

The specific implementation problems listed below are 
derived from the results of the interviews with the commands 



listed above. 
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internal control process. The major implementation problems 
identified in the interviews include: 
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1. Decentralization of the Navy 

2. Manager's resistance to participate 

3. Lack of procedural guidance 

4. Definition of an assessable unit 

5. No standard inventory of assessable units 

6. Vulnerability assessments less than required 

7. Lack of manager training 

8. Paperwork burden 

Each of these areas will now be examined. 

1 . Decentralization of the Navy 

The Federal Managers' Financial Integrity Act 
process is, in general, a very cumbersome process. This is 
particularly a major problem for large decentralized 
organizations such as the Navy. The paperwork aspects of the 
program are compounded by the need to promulgate the program 
down through the Navy chain of command to the lowest 
managerial level. The lowest managerial level is then 
required to complete the required management control reviews 
in a short time frame to satisfy the reporting requirements 
up the chain of command. This layering effect can sometimes 
involve five or more levels, which can slow the overall 
process and make the manager on the bottom of the chain of 
command sometimes perform his work in a crisis mode. 

2 . Manager 1 s res istance to part ic ipate 

With the introduction of any new system to an 
organization there will always be some internal resistance 
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to change that is normal human reaction. The Navy was no 
exception when it tried to implement their internal control 
program. Each interview conducted referred to the problem of 
manager resistance to participate in the program. There were 
several reasons given for this problem. First and foremost, 
the managers believed that by reporting and documenting 
their internal control weaknesses, they were in effect 
putting themselves "on report". Managers thought that the 
program was making them into auditors. Secondly, managers 
believed the enormous time and effort imposed in completing 
the process was not well spent and could be used on more 
productive work. Thirdly, most line managers viewed this as 
a "staff" problem and, therefore, felt that they did not 
need to participate because they believed that internal 
controls only applied to accounting and financial controls 
and not administrative controls. Finally, if the command's 
internal control program coordinator was successful in 
getting the organization's managers to participate, the 
sketchy or nonexistant guidance and training from the 
headquarters level caused a lot of managers to call the 
program a failure before it had a chance to be implemented. 

3 . Lack of pr ocedura 1 guidance 

A major problem for the Navy was that procedural 
guidance on implementing certain areas of the FMFIA was 
inconsistent and overlapping. Some interviewees believed 
that the entire process on how the Navy wanted to implement 



54 



the program was not completely thought out prior to issuance 
of the first SECNAV instruction. In addition, the Navy had 
not completely resolved who was going to be involved in the 
reporting cycle, how to perform vulnerability assessments 
and internal management control reviews, and realistic 
training programs for managers were not ready. This led to 
major confusion among all Navy commands because no one 
really understood the entire process. Initial guidance was 
simply a distribution of the OMB guidelines and GAO 
standards . 

4. Definition of an assessable unit 



The major problem addressed in the interviews was 
that there was not a consistent definition of what an 
assessable unit was and how detailed the assessable unit had 
to be. This problem ties back into the problem of poor 
guidance. Some activities segmented their organizations into 
assessable units based on their organization charts (e.g.. 
Supply, Operations, Administration, etc.) while some 
segmented these into smaller units (e.g.. Supply was 
segmented into purchasing, receiving, shipping and 
disbursing) . 

5 . No_ standard inventory of assessable units 

This is a follow-on problem from the above 
discussion. The point here is that because the Navy had no 
standard inventory of assessable units, it had a problem 
directing which areas Navy commands should review on a 
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systemic basis, because some commands had not segmented 
their commands in the same way as other commands. 

6 . Vulnerability assessments less than required 

The GAO audit noted that agencies have devoted 
considerable resources to making vulnerability assessments, 
and the vulnerability of thousands of operations have been 
assessed. Nevertheless, these efforts have not resulted in 
reliable and useful information to managers. 

In the interview with the Naval Audit Service 
(ref. 10), the problem of lack of good vulnerability 
assessments at the commands that the Naval Audit Service 
had reviewed was discussed. A major problem in this area 
was that managers had a preconceived judgment over what the 



vulnerability of a 


program should be. This 


judgment was 


used 


instead of the process 


discussed earlier 


to 


identify 


the 


controls already 


in 


place that could 


reduce 


the 



vulnerability of that area. As discussed before, 
vulnerability assessments are to be a preliminary analysis 
by the manager on where internal control strengths and 
weaknesses may exist in their programs and on the 
susceptibility of their programs to fraud, waste or abuse. 

7 . Lack o f manager tra ininq 

All interviewees agreed on this point. If the entire 
internal control process is to work and the requirements of 
the FMFIA are to be met, then it is vital that all managers 
receive training in the internal control process. 
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Unfortunately, there was a poor definition of what training 
was required and, therefore, the quality of training was 
unsat i s f actor y . Instructing and training managers must be 
performed to provide them with a better understanding of 
what was required of them. The consensus of opinion was that 
if all the managers were trained in the process, then the 
reviews and reports produced would be of higher quality and 
the Navy would have a better basis for reporting. 

8 . Paperwork burden 

Host interviewees had some comment on the paperwork 
burden of the program as it related to manager resistance to 
the program. The problem pointed out in the interviews was 
that their managers had a firm belief that the entire 
internal management control process was requiring them to 
spend already scarce resources documenting a lot of 

information that they did not feel was particularly useful 
to them. Most managers felt that documenting their systems 
should produce information that could assist them in 

developing corrective actions and planning future work. The 
interviewees noted that this type of comment from managers 
was common and generally came from frustrated managers who 
had resisted the program from the outset. 

G. CONCLUSION 

The Navy is well aware of all of the problems mentioned 
above. Most of the problems identified during the 
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interviews and studies result from the fact that the Navy's 
internal control program has not yet fully evolved into an 
effective program. 



Some of the major 


findings included in 


this 


chapter 
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to achieve 


a 


quality 



internal control program. 

The next chapter will describe some of the Navy's 
solutions to the identified implementation problems. 
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V. NAVY'S SOLUTIONS TO IMPLEMENTATION PROBLEMS 
A. INTRODUCTION 

The GAO audits of the Navy's implementation of the FMFIA 
have commented on the Navy's implementation progress. The 
GAO noted that the "Navy had made progress in developing and 
implementing its internal control evaluation program and in 
reviewing its accounting systems for conformance with the 
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A detailed description of each of these areas is 



presented below. 



B. NAVY'S ACTIONS TO SOLVE IMPLEMENTATION PROBLEMS 

1 . Improving Internal Control Guidance 

NAVCOMPT and CNO recognized that several 
improvements were needed to achieve a quality program and 
emphasized consistent, good quality management control 
reviews, particularly documenting the control process and 
testing control techniques. 

NAVCOMPT and CNO established and clarified a number 
of written procedures to guide commands and activities in 
implementing a satisfactory internal control program. Some 
of these changes include revising the vulnerability 
assessment process from a 2 to a 5 year cycle and providing 
more direction on specific areas to review. 

2 . Us i ng Other Sour ces of Information to Substitute 
for Internal Control Reviews 

A substantial portion of management's resistance to 
the program came from managers who believed that the 
management control review process was duplicating the 
efforts of inspection and audit teams. The internal control 
program process required that the manager review his areas 
of responsibility to identify weaknesses and document the 
entire process. At the same time, the same manager was 
being audited or inspected in the identical area. Most 
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managers felt that this was a tremendous duplication of 
effort and laid the blame on the management control process. 

Recognizing the problem, the new OPNAVINST allows 
Navy activities to use other management control activities 
such as management studies, audit reports, inspections and 
reviews to assess controls and substitute these for internal 
management control reviews. This solution was implemented 
because most agencies believe that audit reports, management 
studies and command inspections are an integral part of an 
effective management control system. 

3 . Integrating audit plans into the management control 
review process 

The Naval Audit Service has a number of functional 
area audit plans that are used by auditors when auditing 
Naval activities. These functional area audit plans serve as 
general guidelines for the auditors to check for compliance 
with directives and procedures. The audit plans do not 
include every possible area that can be reviewed in the 
functional area, but are the minimum effort required by the 
auditor. The reason for this is because the Audit Service 
wants their auditors to have some degree of flexibility when 
reviewing a particular area to investigate additional areas . 

The Navy is attempting to integrate these audit 
plans into the management control review process. This will 
allow activity managers to use these audit plans to aid them 
in performing their internal management control reviews. 
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The Navy hopes that each activity will use these 
audit plans as a baseline to possibly develop checklists of 
their own that can be tailored to specific management 
control problem areas. However, there are pros and cons to 
using this approach. Checklists are a management tool that 
can be used effectively, but they can also be misused. 
Checklists can be effective in ensuring that important 
review areas are not forgotten. They can serve as a reminder 
to managers that they need to ensure adequate review is 
given in each particular area. However, usually checklists 
are not all inclusive. Managers have a tendency to review 
only those areas that are included on the checklist, thereby 
potentially missing areas that need closer management 
review. What the checklist does provide is a point of 
reference; but the checklist does have the potential for 
misuse if the manager relies solely on the checklist to 
complete his management control reviews. 

4 . I mproving Manager Training 

Lack of or no training for the manager was a serious 
problem the Navy needed to solve if the program was to be 
successful. Two areas were developed by the Navy as 
solutions to the problem. DOD disseminated a self- 
instructional course on conducting internal control reviews. 
The Navy believes that when this course is combined with 
better headquarters guidance and quality assurance 
techniques at the local level, it will achieve the desired 
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improvements because proper training will afford managers 
the knowledge required to perform the required tasks within 
the program and hopefully achieve better results. Some 
interviewees, however, found the se 1 f - i ns t r uc t i ona 1 course 
to be too general to be of any use. 

Probably one of the best improvements to the program 
is the internal control program indoctrination that 
prospective Commanding Officers (PCO) and prospective 
Executive Officers (PXO) receive. The goal is to indoctrinate 
as many PCOs and PXOs as possible on the internal control 
program prior to reporting to their new assignments. By 
making these officers aware of the internal control program 
and the importance of establishing and maintaining an 
effective internal control program, it is hoped that 
internal controls can become a mindset among line managers. 
Most interviewees believed that this improvement of 
increasing the consciousness of Navy managers to internal 
controls will go much further in the Navy’s effective 
implementation of the program, because if Commanding 
Officers and Executive Officers take an active interest in 
the program, it can be successful. 

5. Writing an Internal Control Review Plan Based on 

Vulnerability Assessments 

One problem area previously mentioned was that the 
internal control reviews were sometimes duplicating the 
efforts of recently completed audits, inspections and other 
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reviews. To solve this duplication o£ effort problem, the 
CNO, in conjunction with the Naval Audit Service, is writing 
a five year internal control review plan based on the 
results of the Navy's vulnerability assessments. This five 
year plan will be meshed with the Naval Audit Service's five 
year audit plan to determine which areas will be reviewed by 
the Naval Audit Service, and will satisfy the requirement of 
completing a management control review. The resulting audit 
plan and internal control review plan will be reviewed by 
the AVCNO and the Naval Audit Service, and will be 
prioritized based upon the results of the Navy's 
vulnerability assessments. Joint approval of these plans 
will be accomplished by both activities. This is a change 
that is allowed under the recent revision to OMB Circular 
A-123. By merging the internal control plan and audit plan, 
the Navy hopes there will be a reduction in the duplication 
of effort. In addition, if this meshing is successful, the 
Navy believes that the program implementation will be 
improved due to increased functional area coverage, a 
greater number of assessments can be conducted and, best of 
all, there will be improved identification and correction of 
internal control weaknesses. 

6 . Internal Control Information System 

The Navy has developed an innovative alternative to 
the traditional approach to accounting systems evaluations. 
The traditional approach is weak in a number of significant 
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areas. First, the traditional approach has often failed to 
encompass the entire system looking only at individual 
segments of systems. Second, qualitative measurements of 
specific threats facing a system and the resulting risk 
reductions achieved by individual internal controls have not 
been obtained. Lastly, the traditional approach has not 
allowed for cost-benefit analysis of the merit of specific 
internal controls. 

As a specific action to overcome these shortcomings, 
NAVCOMPT has developed the Internal Control Information 
System (ICIS) (ref. 11). The ICIS is a subset of NAVCOMPT ' s 
Consolidated Systems Evaluation Program (CSE). CSE is a 
comprehensive approach to accounting systems reviews to 
determine the adequacy of an accounting system's conformance 
to regulations, data processing soundness, functional 
soundness, and internal control soundness. 

ICIS is a computer/sof tware supported approach to 
internal control review and improvement which addresses each 
of the shor tcomi ngs of the traditional approach to 
accounting systems evaluations. The ICIS reviews entire 
systems instead of individual segments and develops and 
addresses specific threats, associated dollar risks, and risk 
reduction achieved by individual controls. 

ICIS is not a checklist approach to internal control 
evaluation. It is an approach which evaluates the threat and 
potential dollar impact in each area. Expected threat 
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occurrence rates are determined and all controls and their 



risk reduction are computed. This procedure produces a 
listing which shows initial exposure, risk reduction 
achieved by specific controls and the remaining risk after 
all controls are considered. This allows the manager to look 
at each control with regard to its cos t -bene f i t . In 
addition, the ICIS allows managers to use sensitivity 
analysis to explore the impact of adding, deleting or 
modifying internal controls. 

Finally, the ICIS appears to be an efficient, 
innovative approach to accounting systems reviews. It is 
certainly a step in the right direction, and it is hoped that 
this system will prove to be effective in improving reviews 
of internal controls in the Navy’s accounting systems. 

C. OTHER IMPROVEMENTS 

Two other improvements deserve mention here. The 
President's Council on Management Improvement's report 
identified the following two areas of potential improvement 
to the implementation process. The Council looked across 
different government agencies to see what they were doing in 
relation to accomplishing the requirements of the FMFIA. The 
Navy is working on the following two areas. 

1 . Developing a_ Short Form for Management Control 

Reviews 

The Department of the Army has developed a checklist 
approach to the internal management control review. The Army 
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moved in this direction because of the extensive amount of 



Army regulations (not unlike the Navy) that specify how 
functions should be performed so more standardization 
was needed. This was accomplished by adjusting 
responsibility for internal controls around functional 
managers and by moving to a standard checklist. 

The checklists include identification of the task 
under review, the associated risk, control objectives, and 
control techniques. The checklists are designed to aid the 
operating managers in determining if internal controls are 
operating properly within their area of responsibility. 
Operating managers use the checklists to test internal 
controls and provide feedback and suggestions to functional 
managers . 

One interviewee stated that the Navy has done some 
preliminary work in this area, but development of the Navy 
checklists has been slow because of the nature of the Navy’s 
internal control reviews are so diverse. Designing a concise 
checklist has been difficult. Some commands were trying to 
develop local checklists tailored to their specific 
commands. Further investigation by the Navy into developing 
management control review checklists appears warranted, 
since it can be shown that when correctly used these 
checklists can reduce the paperwork burden previously 
discussed. 
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2 * Us i rig a_ New Vulnerab i 1 i ty Assessment Form 

Another area noted by the President's Council was a 
vulnerability assessment short form adopted by the Federal 
Highway Administration. The Navy has modified this form for 
use within the DON. This form provides the manager with a 
concise one page checklist designed to provide a review of 
the general control environment, analysis of inherent risk 
and a preliminary assessment of safeguards. Some 
interviewees believe that the implementation of this new 
form will be very useful to managers because it will allow 
managers to reduce the time and paperwork required to 
perform vulnerability assessments. 

D. SHORTCOMINGS OF THE NAVY’S ACTIONS 

The Navy has made some progress in implementing the 
FMFIA. The Navy’s efforts to develop and improve its 
internal control evaluation program, albeit slow, have 
proven to be relatively successful. Nevertheless, there are 
still some shortcomings in the Navy's program. 

First, the Navy has spent an inordinate amount of time 
identifying and documenting internal control weaknesses and, 
in most cases, planning and taking corrective actions. 
However, the Navy has not routinely tested the corrective 
actions of the internal controls to verify that these 
corrective actions are being sys tema t ica 1 ly implemented and 
the controls are now operating as intended. The Navy needs 
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to ensure routine testing of corrective actions to determine 
their effectiveness. 

Another shortcoming of the implementation process is 
that internal control awareness in the Navy has not 
completely filtered down to all applicable management 
levels. The impression received throughout the interviews 
was that many of the subordinate commands had not fully 
implemented their own internal control programs. To 
completely implement a totally effective internal control 
program, the Navy must ensure that internal control systems 
are implemented at all Naval activities to provide the means 
for preventing fraud, waste, and abuse. The best way to 
achieve this objective is to make internal controls a 
mindset among Navy managers. This requires that the internal 
control program evolve to be part of the management 
organization oft he Navy. 

The Navy needs to find a way to give the line managers 
more incentive to implement and maintain effective internal 
control systems. The line manager must be convinced that 
effective internal control systems are of greater benefit 
to him than weak controls. The benefits must be explained 
to him in terms that he can understand. For example, if the 
line manager can be shown that lack of a specific control 
is draining his resources and requiring him to forego 
meeting mission requirements (such as less ship underway 
time or flight hours, or not enough warfare training 
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exercises to enable his crew to become more battle 
proficient), then effective internal control systems can 
potentially be implemented and line managers will begin 
to associate good internal control systems with increased 
readiness. This effort will continue to be a major challenge 
for top Navy management, because getting this type of 
incentive across to all Navy managers is difficult due to 
the decentralized nature of the Navy’s organization. 

Another shortcoming noted is that the Navy needs to 
concentrate on the results of the program. Strengthening 
internal controls and accounting systems is the bottom line 
of the FMF1A. The Navy needs to concentrate more on the 
substance of the evaluation process and less on 
documentation and report language to achieve the overall 
objective of improving internal controls and accounting 
systems . 

Finally, the Navy’s organization needs to investigate 
how it can ensure the overall effectiveness of its internal 
control program. In the private sector the approach used is 
the formal audit committee. This committee oversees the 
various audits to ensure the overall effectiveness of the 
audits the particular company receives. The members are 
independent of management. This is important because it 
relieves management of any pressure, perceived or otherwise, 
which may impact on the effectiveness of the particular 
audit. The Navy may investigate use of an inter-disciplinary 
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body apart from NAVCOMPT and AVCNO to integrate the various 
internal control concepts and definitions and to develop a 
common reference point. This body's guidance would move to 
develop a standard against which other activities can judge 
the effectiveness of their internal control programs, and 
thus help other Naval activities improve their internal 
control systems. This oversight committee could be charged 
with overseeing the financial reporting process and the 
Navy's internal control system. It could also independently 
ensure that the Navy was making satisfactory progress toward 
improving systemic internal control weaknesses and further 
enhance the Navy's ability to report their accounting 
systems and internal controls in compliance with the FMFIA. 



E. CONCLUSION 

The Navy is working to strengthen its internal 

management control program. While progress has been made by 
the Navy to correct some of the implementation deficiencies 
and smooth out the rough edges, there is still a lot of work 
that the Navy needs to do before it has an effective 
internal management control program and more importantly a 
system of internal controls that will meet the intent and 
the requirements of the FMFIA. 

The last chapter provides a summary along with some 
recommendations and conclusions on what additional actions 
the Navy could possibly undertake to make further progress 
in the implementation of the Act. 
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VI . CONCLUSIONS AND RECOMMENDATIONS 



A. SUMMARY 

The purpose of this thesis was to determine whether the 
Navy has successfully implemented the Federal Managers' 
Financial Integrity Act of 1982; to determine if the Navy 
has resolved their implementation problems, and if the Navy 
has come up with any innovative ideas to make the management 
control process more efficient and effective. 

This thesis consolidates and highlights information on 
the Navy’s implementation problems and their efforts to 
improve their internal control problems. After the initial 
historical background of internal control program 
development in the Federal Government, an explanation of the 
current internal control evaluation system was covered. This 
chapter was presented to give the reader an appreciation of 
the depth of information and workload required by the 
current internal control process. 

The history of the Navy’s Internal Control Program, the 
Navy’s financial management structure and accounting systems 
weaknesses, and the implementation problems the Navy has 
experienced in implementing their internal control program 
was then developed and discussed. The information in this 
chapter was designed to show the reader the historical 
difficulties encountered by the Navy in organizing their 
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program, the type of organizational structure the Navy 
operates under and present the implementation problems 
encountered by the Navy in detail. 

The Navy's solutions to the implementation problems and 
the shortcomings of those solutions were then covered in 
detail. The reader should hopefully obtain from this chapter 
an appreciation of the Navy's efforts in correcting their 
implementation problems. Additionally, it should be apparent 
to the reader how much further the Navy's program needs to 
evolve before it can be judged as being completely 
entrenched in the Navy's organization. 

The generalization of the results of this study are 
limited, given that only a few activities were able to be 
interviewed. Nevertheless, since the activities interviewed 
were senior Navy echelon commands, the results of this study 
could be extended to other Naval activities. 

B. CONCLUSIONS 

Based on the research conducted for this thesis, one 
conclusion reached was that the concept of internal control 
in the Navy has progressed significantly over time since the 
program's inception. It has grown from merely a means to 
detect and prevent fraud to include the means of effectively 
performing a mission or realizing an objective. 

The FMFIA process has produced a heightened awareness of 
the importance of internal controls at all management levels 



73 



and 



has 



reiterated management's 



respons ibi 1 i ty 



for 



establishing and testing those controls. 

The Navy's efforts to fully implement the FMFIA are far 
from complete. Although the basic framework for an effective 
internal control program has been established within the 
Navy, the research conducted indicates further 
implementation must be done before the Navy's program can 
provide an adequate basis for determining that internal 
controls, taken as a whole, comply with the objectives of 
the Act. The Navy has recognized the deficiencies in the 
implementation process and has moved to correct these system 
def iciencies . 

In my opinion, the largest obstacle the Navy needs to 
overcome to make implementation of internal controls 
successful is the line manager’s resistance to participate 
in the program. This problem is compounded by the 
decentralized nature of the Navy's organization. As stated 
before, the Navy's internal control program needs to evolve 
to be part of the management organization. How is the Navy 
to achieve this evolution? My opinion is that the Navy 
needs to go back to basics and have managers assess 
themselves by looking at what they are assigned to do, 
evaluate the results against whether or not they are doing 
it, and if there is a difference between the two, then take 
the appropriate corrective actions. Giving the line manager 



more incentive to have strong internal control systems is 
also extremely important. 

Unfortunately, this simplistic solution will only work 
where the Navy already has good managers in place. 
Implementation of effective internal control programs has 
not been a major problem where good managers existed. Where 
poor managers exist, internal control programs will tend not 
to be successful. If this is the case then increased 
scrutiny over these poor managers will be required to ensure 
the objectives of the internal control program are achieved. 

Other implementation problems and solutions are 
procedural in nature and the solutions will eventually make 
the Navy's internal control program more effective. 

C. RECOMMENDATIONS 

What will be the future of the Navy's internal control 
program? Although a number of Navy managers probably thought 
that this was just another bureaucratic program that would 
die away, my view is that the Navy's internal control 
program with the backing of the FMFIA is here to stay. The 
future of a successful program, however, will depend on a 
number of factors that have been previously discussed. Since 
the program is not going away, it is in the best interest of 
the Navy to make the program work for the Navy and improve 
its internal controls and accounting systems instead of 
making the Navy work for the program. 
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The following actions are recommended: 

1. The ’Navy needs to continue to incorporate the 
internal management control process into the overall 
management process. This would result in greater 
support for the internal control process and would 
relieve duplication of reviews and tracking systems. 

2. The Navy should consider reducing the paperwork 

burden, and reduce staff days required to maintain the 
process by further developing checklists to help 
managers perforin internal control reviews. These 

checklists should include the minimum essential 
controls needed to comply with the internal control 
standards. These checklists would serve to reduce the 
program down to a simple, manageable level. 

3. The Navy needs to continue to gain the support of 
senior line managers in relation to the internal 
control process through incentives in terms the line 
manager can relate to. This is a critical area because 
without these senior manager's support the internal 
control process will not succeed. The Navy's efforts 
in indoctrinating PCOs and PXOs will make this much 
easier . 

4. The Navy needs to continue its efforts to implement an 
effective tracking and follow-up system. Such systems 
are essential to monitor and ensure that actions 
developed to correct internal control deficiencies are 
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completed. The Navy needs to establish a central area 
such ‘as the AVCNO for reporting correction status of 
weaknesses and streamline follow-up for all identified 
weaknesses . 

5. As a related r ecommenda t i on, the Navy could establish 
an improved implementation feedback program. This, 
along with a system of lessons learned, could ensure 
that implementation problems are identified for 
evaluation and serve as a guide for managers to 
determine the actual status of their implementation 
pr ocess . 

6. To fully implement an effective internal control 
program, the Navy needs to develop more effective 
manager training which supports the program and gives 
a set of guidelines for the establishment and reviews 
of internal controls. 

7. The Navy needs to continue to focus on alternative 
ways to complete the management control review process 
which are most cost-beneficial. The Navy has moved 
closer in this direction by now allowing the use of 
audits, inspections and other reviews to serve the 
purpose of management control reviews. 

8. As a long range goal, the Navy should study the 
feasibility of establishing a computer network for 
reporting requirements of the Act. Automating the 
documentation of vulnerability assessments and 
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management control reviews could go a long way toward 
implementing recommendations 4 and 5. 

9. The Navy needs to investigate the use of an 
oversight committee, possibly including outsiders, to 
integrate internal control concepts and definitions 
and to develop a common reference point. This body 
could help ensure the Navy was making satisfactory 
progress toward improving internal control weaknesses 
and enhance the Navy's ability to meet the 
requirements of the FMFIA. 
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